fix(auth): remove Facebook email permission

src/lib/auth/__tests__/auth_platform.test.ts

@@ -0,0 +1,30 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const signInMock = vi.hoisted(() => vi.fn());
+
+vi.mock("next-auth/react", () => ({
+  signIn: signInMock,
+}));
+
+import { AuthPlatform } from "../auth_platform";
+
+describe("AuthPlatform", () => {
+  beforeEach(() => {
+    signInMock.mockReset();
+    signInMock.mockResolvedValue(undefined);
+  });
+
+  it("requests only public profile for Facebook login", async () => {
+    await AuthPlatform.facebookSignIn();
+
+    expect(signInMock).toHaveBeenCalledWith("facebook", undefined, {
+      scope: "public_profile",
+    });
+  });
+
+  it("keeps Google login unchanged", async () => {
+    await AuthPlatform.googleSignIn();
+
+    expect(signInMock).toHaveBeenCalledWith("google");
+  });
+});

src/lib/auth/__tests__/facebook_provider.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  createFacebookProvider,
+  FACEBOOK_AUTHORIZATION_SCOPE,
+  FACEBOOK_PROFILE_FIELDS,
+  mapFacebookProfile,
+} from "../facebook_provider";
+
+describe("Facebook provider", () => {
+  it("requests public profile without email permission or field", () => {
+    const provider = createFacebookProvider();
+
+    expect(provider.options).toMatchObject({
+      authorization: {
+        params: { scope: "public_profile" },
+      },
+      userinfo: {
+        params: { fields: "id,name,picture.type(large)" },
+      },
+    });
+    expect(FACEBOOK_AUTHORIZATION_SCOPE).not.toContain("email");
+    expect(FACEBOOK_PROFILE_FIELDS.split(",")).not.toContain("email");
+  });
+
+  it("does not map an email even when Facebook unexpectedly returns one", () => {
+    const mapped = mapFacebookProfile({
+      id: "facebook-1",
+      name: "Elio",
+      email: "should-not-be-used@example.com",
+      picture: { data: { url: "https://example.com/avatar.jpg" } },
+    });
+
+    expect(mapped).toEqual({
+      id: "facebook-1",
+      name: "Elio",
+      email: null,
+      image: "https://example.com/avatar.jpg",
+    });
+  });
+});

src/lib/auth/auth.ts

@@ -8,7 +8,8 @@
  */
 import NextAuth from "next-auth";
 import Google from "next-auth/providers/google";
-import Facebook from "next-auth/providers/facebook";
+
+import { createFacebookProvider } from "./facebook_provider";
 
 export const handler = NextAuth({
   providers: [
@@ -16,10 +17,7 @@ export const handler = NextAuth({
       clientId: process.env.AUTH_GOOGLE_ID ?? "",
       clientSecret: process.env.AUTH_GOOGLE_SECRET ?? "",
     }),
-    Facebook({
-      clientId: process.env.AUTH_FACEBOOK_ID ?? "",
-      clientSecret: process.env.AUTH_FACEBOOK_SECRET ?? "",
-    }),
+    createFacebookProvider(),
   ],
   // 把 OAuth provider 的 token 塞进 NextAuth session，供前端取用：
   //   - Google: account.id_token     → 调后端 /api/auth/google-login 换业务 token

src/lib/auth/auth_platform.ts

@@ -17,6 +17,8 @@
  */
 import { signIn } from "next-auth/react";
 
+import { FACEBOOK_AUTHORIZATION_SCOPE } from "./facebook_provider";
+
 export type AuthProvider = "facebook" | "google";
 
 export class AuthPlatform {
@@ -27,6 +29,8 @@ export class AuthPlatform {
 
   /** 触发 Facebook OAuth 跳转 */
   static async facebookSignIn(): Promise<void> {
-    await signIn("facebook");
+    await signIn("facebook", undefined, {
+      scope: FACEBOOK_AUTHORIZATION_SCOPE,
+    });
   }
 }

src/lib/auth/facebook_provider.ts

@@ -0,0 +1,32 @@
+import Facebook, {
+  type FacebookProfile,
+} from "next-auth/providers/facebook";
+
+export const FACEBOOK_AUTHORIZATION_SCOPE = "public_profile";
+export const FACEBOOK_PROFILE_FIELDS = "id,name,picture.type(large)";
+
+export function createFacebookProvider() {
+  return Facebook({
+    clientId: process.env.AUTH_FACEBOOK_ID ?? "",
+    clientSecret: process.env.AUTH_FACEBOOK_SECRET ?? "",
+    authorization: {
+      params: { scope: FACEBOOK_AUTHORIZATION_SCOPE },
+    },
+    userinfo: {
+      params: { fields: FACEBOOK_PROFILE_FIELDS },
+    },
+    profile: mapFacebookProfile,
+  });
+}
+
+export function mapFacebookProfile(profile: FacebookProfile) {
+  return {
+    id: profile.id,
+    name: typeof profile.name === "string" ? profile.name : null,
+    email: null,
+    image:
+      typeof profile.picture?.data?.url === "string"
+        ? profile.picture.data.url
+        : null,
+  };
+}